commit 679e57968219d6ef228ca93216ecf2b7334b7e42
author Andy Hung <hunga@google.com> Tue May 16 12:04:50 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed Sep 13 22:05:23 2017 +0000
tree de8d84e1e4f613e279928e9fa49f3b570665d634
parent 81482a925de4a92f3e34e4a85a857227dac24bc4

EffectBundle: Check value size for get preset name

Test: CTS testAllEffectsEqualizer_CVE_2017_0401
Bug: 37536407
Change-Id: I347af04677fc49a01efb549f06ff81d1a00dc4d0
(cherry picked from commit fa5c6c97ee86ff038979cedea5c449be4e2b9899)

media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp

diff --git a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
index dcf3fa0..07ea818 100644
--- a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
+++ b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
@@ -2439,6 +2439,13 @@
             }
             break;
         }
+
+        if (*pValueSize < 1) {
+            status = -EINVAL;
+            android_errorWriteLog(0x534e4554, "37536407");
+            break;
+        }
+
         name = (char *)pValue;
         strncpy(name, EqualizerGetPresetName(param2), *pValueSize - 1);
         name[*pValueSize - 1] = 0;